wrong app certificate revoked

[Rello]

when installing the Data Analytics app in 18.0.4 the message is

Certificate "4353" has been revoked

certificates did not change
https://github.com/nextcloud/app-certificate-requests/tree/master/analytics

I think it might be related to this commit?
d702c3d#diff-130227cf4fad75939e37b7b224923e71
@MorrisJobke is it possible that you killed the analytics-app certificate with this commit?!

[Rello]

Rello/analytics#38

[MorrisJobke]

This came in via #20474 and there I only revoked that specific certificate:

openssl ca -config openssl.cnf -revoke certs/spgverein.crt

Let me check the revocation list.

[MorrisJobke]

Found the issue:

$ openssl x509 -in spgverein/spgverein.old.crt -noout -text | head -n 4
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 4353 (0x1101)
$ openssl x509 -in analytics/analytics.crt -noout -text | head -n 4
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 4353 (0x1101)

They both have the same serial number. Let me check how this could have happened.

[Rello]

thank you @MorrisJobke
it sounds like any fix would require a new root file to be pushed via an NC update.

should I request a new certificate/signature for the app? would this be quicker?

[j-ed]

They both have the same serial number. Let me check how this could have happened.

OpenSSL usually reads the serial number to be used for a new certificate from the serial-file. The number should always be +1 of the last certificate listed in the index.txt file. It might be sufficient to correct the number in the serial-file, if only one certificate with a double serial number has been generated.

[MorrisJobke]

should I request a new certificate/signature for the app? would this be quicker?

Let me sign your existing csr again and then you have a new certificate.

OpenSSL usually reads the serial number to be used for a new certificate from the serial-file. The number should always be +1 of the last certificate listed in the index.txt file. It might be sufficient to correct the number in the serial-file, if only one certificate with a double serial number has been generated.

We found the issue, which originates in a migration of our signing machine, which caused some certs being issued in one place and some in another. We are on it.

[MorrisJobke]

As it is already revoked you can find the new cert at nextcloud/app-certificate-requests@c27d7ee

Sorry for the trouble. :/